Updated: 23rd May 2018
Corona Energy is committed to keeping your personal data secure, handling it fairly and lawfully. This policy sets out how we collect, use, retain and transfer your personal data. This policy will be updated from time to time on this website and we will notify you of any significant changes.
This policy applies to:
- Customers and prospective customers
- Individuals, sole traders, partnerships and companies (where such companies provide us with personal data such as employee names and contact email addresses)
- Individuals to whom we promote products and services
- Individuals who contact us on social media or who visit our website
Who is responsible for your data?
“Corona Energy” and “we” means the following Corona group companies: Corona Gas Management Limited (company number 02879748), Corona Energy Retail 1 Limited (company number 03241002), Corona Energy Retail 2 Limited (company number SC138299), Corona Energy Retail 3 Limited (Company number 02746961) and Corona Energy Retail 4 Limited (company number 02798334). Corona Energy is the data controller of your personal data and is registered with the Information Commissioner’s Office.
We can be contacted at:
Edward Hyde Building, 38 Clarendon Road, Watford WD17 1JW
If you have any questions about your personal data which are not answered by this policy, please contact our data privacy manager (email email@example.com).
What personal data do we collect?
We aim to collect the minimum amount of personal data necessary to achieve the processing purposes. Data we collect from you includes:
- Contact data (your name, email address, postal address, phone number, date of birth and any other relevant information necessary to contact or identify you).
- Financial data (your bank account, payment details and billing records).
- Technical data (internet protocol (IP) address, your log in data, browser type and version, browser plug-in versions, operating system and platform and other technology on the devices you use to access this website. We track technical data by using cookies.
- Usage data (usage of this website and our products and services).
- Marketing and communication data (your preferences in receiving marketing from us and third parties and your communication preferences).
- Energy supply data (your supply start date, meter technical details, tariff [and energy consumption details]).
For quality and training purposes, we may also monitor and record any communications we have with you, including telephone calls and emails.
We may collect data from other organisations including:
- Metering and debt information from organisations involved in the supply of energy.
- Energy brokers.
- Councils and postal services.
- Installers and managing agents.
Using your personal data
In general, we will only use your personal data under one or more of the following circumstances (each a “lawful basis”):
- In order to perform the contract we have or will have with you.
- Where we have a legitimate business interest in our desire to run our business and provide service excellence.
- In order to comply with a legal or regulatory obligation.
- Where you have given consent for marketing by us.
The lawful basis of each of our activities is set out in more detail below:
|Activity||Type of data||Lawful basis|
|Contact you if you have been referred by a broker or requested a quote from us||• Contact|
|• Legitimate business interest (to assist in developing a customer relationship)|
|Provide our services to you, including:|
• Registration as customer
• Managing payments
• Debt recovery
• Marketing and communications
|• Perform the contract|
• Legitimate business interest (to run our business and provide services to you; and debt recovery)
|Internal analysis of energy usage for forecasting and marketing purposes||• Contact|
• Marketing and communications
• Energy supply
|• Legitimate business interest (to develop our business on the basis of analysing customer requirements)|
|Quality monitoring for training and process improvement purposes||• Contact|
• Calls and email
|• Legitimate business interest (to train our staff to provide excellent service levels)|
|Data analytics to improve products and services||• Usage||• Legitimate business interest (to categorise types of customers for our products and services; keep our website updated; develop our business; and develop our marketing strategy)|
|Manage our business and this website through: trouble-shooting, data analysis, testing, systems maintenance, support, reporting and hosting of data||• Contact|
• Marketing and communications
|• Legitimate business interest (to run our business; provide administration and IT services; network security; and fraud prevention)|
• Legal or regulatory obligation
Disclosing your personal data
There will be circumstances where we may need to share your personal data with other people or organisations for the processing purposes set out above. These would include:
- Our parent company, Macquarie Group Ltd, and other companies in the group which may be involved in providing services to you.
- Service providers who provide engineering and installation services, industry collection and aggregation, IT and system administration services.
- Credit reference and debt collection agencies and court officials, bailiffs, solicitors and others assisting us in debt recovery.
- Professional advisers including lawyers, bankers, auditors, insurers and energy brokers.
- Market regulators and other authorities based in the UK to which we are required to report.
- Agents and subcontractors appointed by us to help in performing our contract with you.
- Energy suppliers and other organisations to deal with switching between suppliers.
Protecting your personal data
Corona Energy has implemented appropriate technical and organisational measures to prevent unauthorised or unlawful processing and against accidental loss, destruction or damage of the personal data you provide and expects the same from all its suppliers and service providers. We update and test our physical, logical and procedural security controls on an ongoing basis. We limit access to your personal data to those who need it and train our employees about the importance of maintaining the confidentiality and security of your personal data.
We will retain your personal data only for as long as necessary to fulfil the purposes set out in this policy including the provision of our products and services, the resolution of any disputes or complaints and the detection and prevention of fraud. In some circumstances, personal data will be retained in accordance with statutory and regulatory requirements.
Corona Energy is based in the European Economic Area (“EEA”) but may be required to transfer personal data to third parties outside of the EEA. In this event, we will ensure that safeguards at least equivalent to the EU are in place to protect your data, either by sending to a country deemed as having adequate protection by the EU or appropriate contractual obligations.
How long do we keep your personal data?
We will keep your personal data for as long as necessary in order to achieve the processing purposes. Where you have an account with us, we will retain your personal data for 7 years following the end of the contractual relationship. If we are required to keep it for longer (for example, for our legal obligations), we will delete it as soon as we have no further need to keep it.
Your legal rights
You have certain rights in law under the EU General Data Protection Regulation in relation to your personal data:
- Access – you can request a copy of the personal data we hold on you.
- Rectification – you can request that any incorrect personal data we hold on you is amended.
- Erasure – you can ask us to delete your personal data if it is no longer necessary for the purpose for which it was originally processed or if there are no overriding legitimate grounds for the processing.
- Object to or restrict processing – you may restrict the processing of your personal data in certain circumstances.
- Portability – you may request that we transfer your personal data in a structured, commonly used and machine-readable format to you or a third party chosen by you.
- Withdraw consent – where we rely on your consent to process your information, you can withdraw such consent at any time, although this may restrict or prevent our ability to provide you with products and services.
If you wish to exercise any of the above rights, you should contact our data privacy manager.
Corona Energy’s suppliers and service providers are expected to co-operate with us when any of the above rights are exercised and such suppliers and service providers process personal data of the requestor.
A cookie is a small file that, if you agree, we store on your browser or the hard drive of your computer if you agree. Cookies contain information that is transferred to your computer’s hard drive.
We use the following cookies:
- Strictly necessary cookies. These cookies are required for the operation of our website including, for example, those which enable you to log into secure areas of our website.
- Analytical/performance cookies. These allow us to recognise and count the number of visitors and to see how visitors move around our website when they are using it. This helps us to improve the way our website works, for example, by ensuring that users are finding what they are looking for easily.
- Functionality cookies. These are used to recognise you when you return to our website. This enables us to personalise our content for you, greet you by name and remember your preferences (for example, your choice of language or region).
- Targeting cookies. These cookies record your visit to our website, the pages you have visited and the links you have followed
You can block cookies by activating the setting on your browser that allows you to refuse the setting of all or some cookies. However, if you use your browser settings to block all cookies (including essential cookies) you may not be able to access all or parts of our site.
If you would like to make a complaint, please contact our data privacy manager (email firstname.lastname@example.org).
You also have the right to raise concerns with the Information Commissioner’s office on 0303 123 1113 or at https://ico.org.uk/concerns/ if you believe that your data protection rights have not been adhered to.